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ABSTRACT 


This thesis evaluates the ability of the Xpress-MP software package to solve 
complex, iterative mathematical-programming problems. The impetus is the need to 
improve solution times for the VEGA software package, which identifies vulnerabilities 
to terrorist attacks in electric power grids. VEGA employs an iterative, optimizing 
heuristic, which may need to solve hundreds of related linear programs. This heuristic 
has been implemented in GAMS (General Algebraic Modeling System), whose 
inefficiencies in data handling and model generation mean that a modest, 50-iteration 
solution of a real-world problem can require over five hours to run. This slowness 
defeats VEGA’s ultimate purpose, evaluating vulnerability-reducing structural 
improvements to a power grid. 

We demonstrate that Xpress-MP can reduce run times by 60%-85% because of its 
more efficient data handling, faster model generation, and the ability, lacking entirely in 
GAMS, to solve related models without regenerating each from scratch. Xpress-MP’s 
modeling language, Mosel, encompasses a full-featured procedural language, also lacking 
in GAMS. This language enables a simpler, more modular and more maintainable 
implementation. 

We also demonstrate the value of VEGA’s optimizing heuristic by comparing it to 
rule-based heuristics rules adapted from the literature. The optimizing heuristic is much 
more powerful. 
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EXECUTIVE SUMMARY 


This thesis enhances an existing software package for analyzing the vulnerability 
of electric power grids to terrorist attacks. 

Since the terrorist attacks on 11 September 2001, the U.S. is reassessing the 
vulnerability of its critical infrastructure. Electric power grids are key infrastructure 
systems that are critical to the United States’ economy and security. 

The VEGA tool, developed by researchers at the Naval Post Graduate School and 
the University of Texas at Austin, is an integrated system for analyzing the vulnerability 
of electric power-transmission grids to terrorist attacks. At VEGA’s core is an 
optimization model that posits terrorists with limited offensive resources to carry out 
physical attacks on a given power grid. Solution of the model identifies components in 
order to maximize disruption, i.e., unserved demand for energy. We deem substations, 
transformers, buses, lines, and generators to be interdictable components, provided 
sufficient interdiction resource is applied. 

This thesis seeks to improve computation times for the Interdicting DC Optimal 
Power-Elow Heuristic (IDCH), which approximately solves the optimization model 
within VEGA. IDCH is currently implemented in the General Algebraic Modeling 
System (GAMS) and uses a highly efficient solver, CPEEX. However, due to inefficient 
model generation and data handling, GAMS can take hours to analyze a grid and identify 
critical components. We implement IDCH in Xpress-MP, a powerful optimization 
software package that is more efficient in generating models and handling data. Average 
run times are reduced by 75.7% with Xpress-MP; the greatest reduction is 84.6%. The 
thesis also points out some of the other advantages of Xpress-MP, which include dynamic 
arrays, functions and procedures, and compilation. 

This thesis also investigates the actual effectiveness of IDCH for analyzing the 
vulnerability of an electrical power grid to terrorist attacks. To do this, we compare the 
interdiction plans generated by IDCH to the plans produced by adapting the heuristic 
rules proposed by Albert, Albert and Nakarado (AAN) in their work “Structural 
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Vulnerability of the North Ameriean Power Grid.” AAN ignore eleetrical-engineering 
realities in their analysis and use heuristie rules in an attempt to find interdietion plans 
that maximize a simple surrogate for disruption (i.e., unmet demand for energy). We 
implement variations of their heuristic rules that are sensible from an electrical 
engineering standpoint, and measure effectiveness in terms of realistic estimates of 
disruption, such as unserved energy. Overall, the AAN rules perform poorly and 
inconsistently compared to IDCH. 



I. INTRODUCTION 


The VEGA software paekage (Vulnerability of Eleetric Power Grids Analyzer), 
developed at the Naval Postgraduate School and the Elniversity of Texas at Austin 
[Salmeron et al. 2004A, 2005], is an integrated system for analyzing the vulnerability of 
an electric power-transmission grid to a coordinated terrorist attack. At VEGA’s core is 
an optimization model whose solution identifies a set of grid components that is most 
critical to system functionality: Eor fixed levels of attack resources, one set of 
components is more critical that another if (a) either set can be feasibly attacked and 
disabled, and (b) disabling the first set causes more “disruption” than disabling the latter. 
Disruption is measured in terms of unserved demand for energy. This thesis seeks to (a) 
improve computation times for the heuristic algorithm currently used to approximate the 
solution to the optimization model, and (b) demonstrate the value of these improvements 
when analyzing real-world transmission grids. 


A. BACKGROUND 

Since the terrorist attacks on 11 September 2001, the U.S. is reassessing the 
vulnerability of its critical infrastructure. Electric power grids are key infrastructure 
systems that are vulnerable to terrorist attacks, and the Department of Homeland Security 
has taken note [Department of Homeland Security 2003]. 

In the past, an electric-power utility company was concerned with the 
vulnerability of its system to natural disasters, unplanned outages caused by equipment 
failures, and minor man-made problems (e.g., cars running into power poles, people with 
rifles taking pot shots at insulators). Today, a utility must also be concerned with the 
prospect of multiple, simultaneous attacks on important equipment in its system. This 
threat is real given that (a) U.S. forces in Afghanistan discovered Al Qaeda 
documentation about a facility that controls power distribution for the eastern U.S., and 
(b) maps of the U.S. electrical transmission grid are publicly available for less than $100 
on the Internet [Energy Pulse 2003]. 
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Vulnerability to attack has increased in recent years, too. As demand for 
electricity rises, the reserve levels in transmission capacity decrease unless adequate 
capacity is added. But adequate transmission capacity has not been added [Report of the 
National Energy Policy Development Group 2001]. This means that the “safety 
cushions” that utilities have built into their systems to handle failures, intentionally 
caused or not, have diminished. Clearly, utilities have an increased need to be able to 
analyze the adequacy of their reserve levels with respect to potential failures. 

The discussion above motivates the development of optimization models to 
represent the problem of terrorists attacking a power system. By studying how to attack 
power grids, insight can be gained about how to protect them. 

There are many types of “vulnerability analyses” in the electric power industry 
(see the overview in NERC [2002]), but only VEGA quantifies the amount of unserved 
demand that would accrue from a worst-case attack (Salmeron et al. [2004A, 2004B]). 
VEGA quantifies this through a bilevel optimization model, although only heuristic 
solution procedures have proven viable for realistic problems. VEGA’s Interdicting 
Optimal DC Power-Elow Heuristic (IDCH) repeatedly solves two submodels: a linear 
program (EP) known as DC Optimal Power-Plow (DCOPP), and a mixed integer 
program (MIP) known as the “interdiction approximating master problem” (lAMP). 

All submodels solved in IDCH are currently generated using the General 
Algebraic Modeling System (GAMS) [2004] and solved with CPEEX [2004] or any other 
MIP solver which can be called from GAMS. This thesis looks to reduce computation 
times for this procedure by implementing it entirely using the Xpress-MP optimization 
software [Dash 2005]. All submodels are written and generated using Xpress’s Mosel 
algebraic modeling language, and are solved using the Xpress-MP solver. Reducing 
computation time is crucial because it allows VEGA’s users to: 

(a) solve more problem instances (e.g., under different assumptions on load 

conditions, terrorist resources, etc.), and 

(b) run more iterations, which may improve the accuracy of solutions. 
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In turn, (a) and (b) allow us to better assess whieh components are in greater need of 
protection, which is VEGA’s ultimate purpose. 

The current GAMS implementation spends approximately 90% of its total 
computation time handling data (i.e., reading the data, creating intermediate data 
structures, reading the solution, and creating the solution output) and model generation 
(i.e., creating the structures required for the problem to be solved by the chosen solver). 
For example, every iteration of the algorithm, when applied to a model of the ERGOT 
grid (Electric Reliability Council of Texas), requires one minute of CPU time, of which 
only 4 seconds are devoted to actually solving the model. 

The Mosel technology within Xpress-MP is similar to structured programming 
languages in that it allows writing and using functions and procedures, while being able 
to embed mathematical programs. This allows IDCH to be modularized, which will 
make future improvements easier to incorporate. GAMS supports neither functions nor 
procedures. 

GAMS does use concise algebraic statements to define models, but the language 
limits the user’s ability to control data structures. Mosel allows a great deal of control 
over data structures while also using concise algebraic statements to define models. As 
one example, Mosel efficiently implements an arbitrary index calculation into a 
multidimensional array. 

A second part of this thesis demonstrates IDCH’s capabilities. We compare 
results that IDCH achieves to the results obtained using variants of the methods described 
by Albert, Albert, and Nakarado [2004] in their paper “Structural Vulnerability of the 
North American Power Grid.” For simplicity, we shall often refer to this paper and its 
authors as “AAN.” 

AAN measure network functionality using crude connectivity measures in the 
grid rather than measuring how well the grid actually performs (e.g., the fraction of 
demanded energy that is actually supplied). Furthermore, AAN make no attempt to 
determine worst-case attacks in terms of their surrogate for grid functionality: They only 
show that one heuristic rule seems to be better than two other rules, when measured using 
their surrogate. This thesis will (a) simulate the experiments performed by AAN—for 
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example, measure changing system functionality as substations are “interdicted,” i.e., 
attacked and disabled, following a specific rule—but use justifiable, electrical¬ 
engineering concepts to measure system functionality, and (b) compare those results to 
IDCH’s results. 

AAN perform their analysis on the entire North American power grid, which 
consists of over 10,000 generating units having a total production in excess of 760 
gigawatts (GW), and over 40,000 transmission lines. Conducting this type of analysis on 
such a large grid would be a daunting task for us, but it would also be misleading. The 
grid is actually divided into three main sub-systems: the Eastern interconnection, the 
Western interconnection and the Texas interconnection. These systems have only modest 
interconnection capabilities, i.e., they operate nearly independently, and thus are never 
analyzed together by power engineers [North American Energy Working Group 2002]. 
Therefore, this thesis will only analyze individual “interconnections,” specifically the 
Western and Texas interconnections. 

B, THESIS OUTLINE 

Subsequent chapters in this thesis are organized as follows: Chapter II introduces 
the DCOPE, which is the basis for the interdiction model used in VEGA. That chapter 
also defines lAMP and describes the heuristic solution procedure currently in use. 
Chapter III then shows how Xpress-MP makes IDCH run more efficiently, and provides a 
detailed comparison of solution times between GAMS and Xpress-MP. Chapter IV 
provides additional computational results, including the comparisons with the techniques 
suggested by AAN [2004]. Chapter V provides a summary of results. 
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II. A HEURISTIC FOR OPTIMIZING INTERDICTIONS OF 
ELECTRICAL POWER GRIDS 


This chapter introduces the Interdicting DC Optimal Power-Flow Heuristic 
developed by Salmeron et al. [2004A, 2004B, 2005], although first named “IDCH” here. 
IDCH incorporates a DCOPF model and an lAMP. DCOPF is a LP that is solved many 
times using data that represent different states of the power grid after a set of components 
is disabled by interdiction; and a set of such LPs must be solved for each of a set of 
interdiction plans. lAMP is a MIP whose solution identifies a set of components whose 
interdiction is (a) resource-feasible, (b) consistent with respect to certain logical 
restrictions, (c) never repeats a previously generated interdiction plan, and (d) maximizes 
the sum of estimated “component-interdiction values.” 


A, BACKGROUND 

Salmeron et al. [2004B, 2005] describe an exact interdiction model that represents 
an instance of a bilevel mixed-integer program (e.g., Bard and Moore [1990]). In theory, 
this model identifies the maximum amount of disruption that a group of terrorists could 
cause to a power grid using limited interdiction (offensive) resources. However, the 
model is currently too difficult to solve exactly, by direct means or through 
decomposition, using data for a realistically sized electrical grid. As a result, this thesis 
focuses on applying the heuristic, IDCH. Although solutions found by IDCH may not be 
optimal, Salmeron et al. [2004A, 2005] show that IDCH provides good results for two 
small IEEE Reliability Test Systems. Thus, we expect it to perform well on larger, real- 
world grids. 

The IDCH algorithm is straightforward, and may be viewed in terms of two 
competing “players.” On one side is a power-system operator (SO) who wants to meet 
all regional demand for energy, while minimizing production costs. On the other side is a 
group of terrorists that wants to apply its limited resources to cause maximal damage to 
the grid, i.e., maximize the amount of unserved demand for energy, or its cost to society. 
Both sides are assumed to have perfect information as to how power can be transferred 
through the grid. 
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IDCH begins with the SO finding the cheapest way to produce enough energy to 
meet demand over a given period of time. For simplicity, let us assume that demand and 
costs are constant over that period, so that the SO can optimize the operation by solving 
one instance of DCOPF. (DCOPF minimizes the instantaneous cost of power generation, 
but since demand and costs are constant, results differ only by the multiplicative factor of 
“hours.”) Typically, no unserved demand arises at this point, but if that becomes 
unavoidable, DCOPF will minimize the cost of generation plus the penalty for unserved 
demand. 

The terrorists then replicate the SO’s solution, and examine the power flows in the 
grid. From these values, they estimate the importance of each component, to system 
functionality, on an individual basis; for instance, this estimated value might simply be 
the load (which is equivalent to energy) carried by the component, be it a transformer, 
substation, bus, line or generator. (Strictly speaking a substation is a collection of 
components, but can be viewed as a single component for purposes of interdiction.) The 
terrorists then determine “the estimated most-valuable” set of components that they can 
feasibly interdict, i.e., without exceeding their interdiction assets. The interdiction is 
carried out, and the SO responds optimally to the loss of the interdicted components. He 
does this by solving a new instance of DCOPF, one that reflects the newly interdicted 
components, and by then implementing the model-suggested generation levels, which, in 
turn, lead to the flows predicted by DCOPF. Then, the terrorists view the new power 
flows, make new estimates of component values, and select a new feasible interdiction 
plan without duplicating any of their previous plans. This process repeats for a fixed 
number of iterations, and the interdiction plan that yields the most unmet demand for 
energy is deemed an approximation to the optimal solution of the interdiction problem. 


B, POWER-FLOW MODEL 

The DCOPF model forms the backbone of IDCH. DCOPF is a linear program 
that minimizes instantaneous generation cost plus the penalty associated with unmet load. 
The model provides an approximation of an exact nonlinear model, but the 
approximation is adequate for high-level security analyses such as ours [Wood and 

Wollenberg 1996, p. 514]. We represent DCOPF as a standard LP: 
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DCOPF: / = min c\ 


s.t. Ax = b 
0<x<u 

where A is an mxn matrix, and all vectors conform. The constraints A\ = h represent 
flow balance constraints for power, and admittance constraints. The variables x represent 
power generation and flows, unmet demands, and phase angles. In the actual model, 
some variables will have -Uj < Xj < Uj , but any LP can be converted to one in which all 

variables are non-negative as shown. Appendix A contains a detailed formulation for this 
model as used in Salmeron et al. [2004A, 2004B, 2005]. 

The demand on an electrical grid varies throughout the day as can generation 
costs and unmet demand penalties. Therefore, measuring the cost of supplying and not 
supplying energy (i.e., power integrated over time), over a 24-hour period, provides a 
better measure of the vulnerability of the grid. This modification of the basic model is 
handled through a standard load-duration curve (LDC). The LDC approximates 
continuously varying data by (a) positing a set of time periods p = with durations 

tp, such that = 24 hours, (b) defining a constant cost and penalty vector Cp for each 

p 

period p, (c) defining a constant demand vector dp for each p, and (d) incorporating dp 
into a right-hand-side vector bp. (A simplistic approximation of a LDC for a one-day 
period could consist of f = 3 “segments,” representing “peak,” “standard,” and “valley” 
loads.) If fp now denotes the cost of supplying energy, the multi-period version of 
DCOPF is: 

horp = \,...,P, 4=t^minCpX^ 

s.t. ^x^=b^ 

0 < x^ < u. 

In the presence of interdiction, the multi-period DCOPF must be extended over 

multiple days to account for differences in component repair times (e.g., a line might 

require 48 hours to repair, a bus might require 168 hours). Thus, the index p (“time 

period”) now represents the length of time the grid is in a particular state of repair and 

subject to a particular segment of the LDC. “Period” could also cover within-week 
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variations, as well as seasonal demand variations if eomponent repair times were to 
extend for months. 

An interdiction plan 6 is a binary vector defined such that <5'^ = 1 if component k 
is interdicted, and <5^. = 0 otherwise. A component that is interdicted forces certain 

variables and constraints to be eliminated. For instance, if a substation is interdicted, all 
lines connected to that substation, along with associated flow variables and/or admittance 
constraints, must be eliminated from the problem. One way to represent this is: 

s.t. 4x^ = (bJ. Vz^/^(6) (2.1) 

where 

• yf.Xp = ’ 

• fp(S) is the index set for constraints that must be eliminated in period p if 
interdiction plan 8 is carried out, and 

• (8)) = 0 if Xj must be eliminated given 8 , and (8)) = Uj otherwise. 

Note that the above representation excludes unnecessary constraints induced by i e (8) 

but, for simplicity, all original variables xj are maintained in the formulation, with 
“eliminated” variables being fixed to zero. 

The total cost of an interdiction plan interdiction 8 is 

^(8) = S4(4.8)' (2-2) 

P 

And, the interdiction problem we (actually, the terrorists) would like to solve is 

1-DCOPF: maxF(8), (2.3) 

6gA 

where 8 e A represents interdiction-resource constraints plus the fact that interdictions 
are binary decisions. 
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C. AN OPTIMIZING INTERDICTION HEURISTIC (IDCH) 

The heuristic outlined in Salmeron et al. [2004A, 2004B, 2005] to solve I-DCOPF 
approximately has two parts that are solved repeatedly: (a) lAMP finds a resource- 
feasible interdiction plan 8 that maximizes the sum of estimated values for individual 
interdictions, subject to some logical constraints, and (b) F(8) is evaluated by solving 
multiple instances of DCOPF, once for each period corresponding to a repair state of the 
grid and a segment of the LDC. The heuristic, IDCH is summarized below. Note that 
“the full study length” denotes the maximum length of time that might be required to 
repair all interdicted components. 

Outline of IDCH 

(a) Set iteration r := 1, 8* := 8^ := 0 and evaluate F(8^), i.e., evaluate the cost 
of operating the grid (including any unmet demand penalty, although unmet demand is 
unlikely given 8^ := 0 ) over the full study length given no interdictions. Set F* := F(5^) . 

(b) Use the power-flow patterns at the current iteration to calculate the 
“value” Vk of each component k. Vt depends on the power flow through, out of, or into a 
component and reflects repair time. (Components that require a long time to repair are 
intrinsically more valuable to the terrorists.) The values are actually computed as moving 
averages, except that if a component is interdicted in iteration t , its value remains the 
same in iteration T + l. 

(c) Set + \ and solve lAMP for 8*^: 

max ^ FA 

k 

s.t. Interdiction resources are not exceeded. 

Components that are indirectly interdicted are not directly interdicted. 

No previous interdiction plan, 8^,...,8*^ ', is repeated, and 
All variables 5^ are binary, 0-1. 
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(d) Evaluate F{6^). If F{6^)> F*, then 8^ is the best interdietion plan 
found thus far, so set F* := F{6^) and 8* := 8^. 

(e) If stopping criteria are satisfied stop, else return to step (b). 

The detailed mathematical formulation of the lAMP is presented in Appendix B. 
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III. IMPLEMENTATION OF INTERDICTING OPTIMAL POWER 
FLOW HEURISTIC IN XPRESS-MP 


Section A of this chapter introduces the Xpress-MP/Mosel software package 
(“Xpress”) as an alternative to GAMS, and describes differences between these packages. 
Section B describes the implementation of the DCOPF subproblem in Xpress, and 
Section C describes the implementation of IDCH’s master problem, lAMP. Section D 
provides a comparison of computing times for IDCH using Xpress and GAMS. Section 
E provides some programming tips regarding Mosel. 

A. BACKGROUND ON MOSEL AND XPRESS-MP 

Mosel is the algebraic modeling language included in the Xpress “package,” 
designed and sold by Dash Optimization [Xpress-Mosel Users Guide 2004]. Mosel 
allows a mathematical program to be written in concise algebraic statements which 
generate one or more model instances. Mosel calls the Xpress-MP solver to solve those 
instances. This thesis uses Xpress as an alternative to GAMS because Xpress 
incorporates dynamic objects, functions and procedures, efficient model generation, and 
compilation, which GAMS does not incorporate. 

1. Dynamic Objects 

Mosel supports the use of dynamic objects which do not require pre-declaration of 
an object’s size. This allows data structures to be smaller in Mosel than the 
corresponding structures in GAMS. Because Mosel has more efficient data structures, it 
can execute loops more efficiently than GAMS. Such loops are used repeatedly when 
generating a single model instance, let alone many model instances. 

2, Functions and Procedures 

Mosel supports the use of functions and procedures. Functions and procedures 
are subroutines that can be called, with arguments, by the main part of a program or by 
another subroutine; a function returns a value while a procedure does not. The use of 
functions and procedures allows for this program to be built in modules, which simplifies 
maintenance and updates. GAMS supports neither functions nor procedures. 
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3. Model Generation 

Every time GAMS solves a model instance, it must “generate” the instance. That 
is, it must create, from scratch, the data structures, as files, that define the model for the 
solver. If modeling is carried out appropriately, Mosel does not need to regenerate a 
model that is a slight modification of a previously generated-and-solved model. 
Modifications are made by changing bounds on decision variables and by changing 
parameters associated with decision variables in the objective function. 

Xpress has another advantage in that its generation engine, Mosel, and its solver, 
Xpress-MP, are tightly coupled. As a result, the interfacing between the generator and 
solver is carried out without the need for intermediary files whose use entails 
inefficiencies. 

4. Compilation 

Mosel is a programming language, and models written in Mosel are compiled 
prior to execution. When a Mosel (.mos) file is compiled it creates a Binary Model 
(.him) file. The .him files contains a (semi-)compiled version of the .mos file. In this 
form, the model is ready to be executed and the .mos file is not required anymore. To 
actually “run” the model, the .him file must be read in again by Mosel and then executed 
[Xpress-Mosel Language Reference Manual 2003]. This allows for the author(s) of the 
model to protect their intellectual property, while distributing their model to various users 
without providing the source code. 

GAMS also has this capability (i.e., secure work files), if the user has the proper 
“privacy license.” However, GAMS requires additional work to produce the secure work 
files because the privacy license corresponds to the GAMS license of the individual user 
who is going to run the program [GAMS 2001]. This means that one program file must 
be created and distributed to each user. Furthermore, if the user upgrades GAMS and the 
license changes, the work file must be rebuilt and redistributed to that user. In contrast, 
the .him file from Xpress can be used by anyone that has a current Xpress license. 

5. Other Advantageous Features of Mosel, and One Disadvantage 

Mosel easily reads input files. The following example shows Mosel’s format for 

input of data from a file and an example of the code that reads the data from the file. 
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Bus_par: [ 


1') 

[false 

true 

2 

168] 

1002 ' ) 

[false 

true 

2 

168] 

1003 ' ) 

[false 

true 

2 

168] 

1004 ' ) 

[false 

true 

2 

168] 


. . .] 

initializations from 'data\Bus_par.dat' 

[Angle_fixed, B_interdictable, Int_res_bus, Int_dur_bus] as 
'Bus_par'; 

end-initializations 

finalize (Bus); 

In this example, four different parameters for buses are imported into the respective 
declared arrays for holding the data. As the data is read from the file, the elements of the 
set Bus (e.g., 1, 1002, 1003, 1004) are defined. The finalize () command prevents 
new elements from being added to the set. (This command is optional, but ensures that a 
new element is not added to the set inadvertently; furthermore, operations with a 
“finalized” set can be carried out more efficiently.) This useful feature in Mosel means 
that the elements of a set need not be defined in advance of the data that refers to the set. 
GAMS requires that all elements of a set be defined prior to using that set. 

GAMS also reads input files, but it must be done carefully because GAMS 
requires the use of the include command. This command operates like the “paste” 
function of any word processor. It literally “pastes” the file’s data into the source code at 
the include statement’s location. Mosel also has an include command that operates 
in this manner, but it has an input file format and command that reads the file, as shown 
in the example above, that is much more flexible. This flexibility is shown by IDCH only 
requiring 21 data files for the Xpress version as opposed to the 29 files required in the 
GAMS version. 

Another useful feature of Xpress-MP is that a model is easily called by a Java, 
VB, or C++ program. This thesis utilizes this feature to run the IDCH multiple times 
with differing levels of interdiction resource. We also use this feature to integrate the 
Xpress programs into VEGA as an embedded function, rather than as external programs, 
as necessitated by GAMS. 
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In our experience, the only disadvantage of modeling with Mosel, is that it forces 
the user to use the Xpress-MP solver. GAMS allows the user to select from a variety of 
solvers, e.g. CPLEX, XA, and even Xpress-MP. 


B, IMPLEMENTATION OF THE DCOPF SUBPROBLEM IN IDCH 

The mathematical formulation of DCOPF is covered in the previous chapter and 
in Appendix A. For each iteration t of IDCH, one instance of DCOPF must be solved 
for each repair-state of the network and for each segment of the FDC. In our test 
problem, the FDC has three segments, and up to three repair states. Thus, up to nine 
instances of DCOPF must be solved in each iteration of IDCH. 

Our computational experience shows that it is most efficient to generate, from 
scratch, a “baseline instance” of DCOPF in each iteration of IDCH, but only one. Thus, 
each iteration generates (and solves) an instance for some period p = \, but does not 
regenerate the model instances for p = 2,...,P, where P may be as large as nine in our 
examples. For p > I, the baseline model is simply modified by changing bounds on 
variables and changing parameters associated with variables in the objective function, 
and then resolved. GAMS does not have this capability, and must regenerate DCOPF for 
each p. Thus, by using Mosel, we avoid regenerating 100%x(F’-l)/F’ of the model 
instances that must be solved. Furthermore, Xpress generates an individual model 
instance much faster than GAMS. For example when using the ERCOT grid (see 
Chapter IV Section C), GAMS requires approximately ten seconds to generate an 
instance of DCOPF while Xpress requires only two seconds. 


C. IMPLEMENTATION OF THE IDCH MASTER PROBLEM 

The implementation of the IDCH master problem, lAMP, follows the 
mathematical formulation of Appendix B. Dynamic arrays help create the master 
problem more efficiently in Mosel than is possible in GAMS. The following lines of 

code show how to accomplish this for a model that only interdicts buses; 
declarations 

Delta_bus : dynamic array (Bus) of mpvar; 
end-declarations 
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forall(i in Bus | B_interdictable(i)) do 
create(Delta_bus(i) ) ; 

Delta_bus(i) is_binary; 

end-do 

(In Xpress-MP, when dynamic arrays are used for decision variables, each of them must 
be “created” explicitly.) 

To prevent the master problem from identifying a particular interdiction plan 
more than once, the following constraints are included at iteration t of IDCH: 

for f = 2,...,l--l (3.1) 

k\d[=\ k 

The remaining constraints for lAMP are defined in the initial generation of lAMP to find 
the first interdiction plan. But, all constraints in lAMP from iteration r-l to iteration T 
are the same, except that one instance of Equation (3.1), for T-T-l, is added. Only 
this constraint needs to be generated in iteration r, as shown by the Mosel code below. 
(Remarks; int_Overlap () is a dynamic array of constraints, corresponding to Equation 
(3.1), one of which is created in each iteration. Gen, Bus, Sub, and Line are sets for 
the individual components, All_(delta_xxx is the array where former interdiction 
plans are stored for components of type xxx, Delta_xxx is the interdiction decision 
variable for component xxx, and X_inter(dictable is a true/false structure. 

ind_iter corresponds to the iteration counter r .) 
declarations 

Int_Overlap: dynamic array(Iter) of linctr; 
end-declarations 


if(Ind_iter > 2) then 

Int_Overlap (Ind_iter-1) := siim(g in Gen | 

exists(All_delta_gen(Ind_iter-1,g)) and G_interdictable(g)) 

Delta_gen(g) + siim(l in Line | 

exists(All_delta_line(Ind_iter-1,1)) and 

L_interdictable (1) ) Delta_line (1) + siim(i in Bus | 

exists(All_delta_bus(Ind_iter-1,i)) and 

B_interdictable (i) ) Delta_bus(i) + siim(s in Sub | 

exists(All_delta_sub(Ind_iter-1,s)) and 

S_interdictable (s) ) Delta_sub(s) <= siim(g in Gen | 

exists(All_delta_gen(Ind_iter-1,g)) and 

G_interdictable (g) ) 1 + siim(l in Line | 

exists(All_delta_line(Ind_iter-1,1)) and 

L_interdictable (1) ) 1 + siim(i in Bus | 

exists(All_delta_bus(Ind_iter-1,i)) and 

B_interdictable (i) ) 1 + siim(s in Sub | 

exists(All_delta_sub(Ind_iter-1,s)) and 
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S_interdictable(s)) 1-1; 

end-if 

D. EFFICIENCY OF XPRESS-MP VERSUS GAMS 

The main goal of this thesis is to develop a more effective IDCH by reducing its 
run time. The last few sections describe why implementing IDCH in Xpress should be 
more efficient than implementing it in GAMS, provided that solve times are comparable 
in both cases. To demonstrate this improvement, this section compares run times for both 
versions of IDCH on a 2.0 GHz Pentium IV computer having I GB of RAM. First, we 
investigate two separate data sets and run the heuristic for 50 iterations while varying the 
amount of interdiction resource. The datasets for Electric Reliability Council of Texas 
(ERCOT) and Western Electricity Coordinating Council (WECC) are taken from test 
cases prepared by the North America Electric Reliability Council as part of a database 
available from Powerworld [2005]. The run times are presented in Table 1. 


Dataset 

Total 

GAMS/CPEEX 

Xpress Run 

Reduction in Run 


Resources 

Run Time 

Time 

Time for Xpress (%) 

ERCOT 

5 

57 min 

16 min 

71.93% 

ERCOT 

10 

58 min 

15 min 

74.14% 

ERCOT 

15 

33 min 

13 min 

60.61% 

ERCOT 

20 

59 min 

16 min 

72.88% 

WECC 

5 

3 hrs 27 min 

40 min 

80.68% 

WECC 

10 

3 hrs 28 min 

32 min 

84.62% 

WECC 

15 

2 hrs 20 min 

28 min 

80.00% 

WECC 

20 

3 hrs 29 min 

42 min 

80.82% 


Table 1. Run times for GAMS/CPEEX versus Xpress. These times are for 50 iterations of 
IDCH applied to the ERCOT and WECC datasets. 

The reduction in run times shown in Table 1, between Xpress and 
GAMS/CPEEX, does not result from differences in solution times for the individual 
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solvers. In fact, CPLEX solves lAMP about five seconds faster than Xpress-MP, on 
average, while both solve DCOPF in approximately the same amount of time. As a 
result, Xpress’s efficiency in model generation, and the ability to solve a previously 
generated model without regenerating it, accounts for the reduction in run times exhibited 
in Table 1. 

Table 1 shows that Xpress reduces run times significantly compared to 
GAMS/CPLEX. The smallest reduction is 60%, the largest is 85%, and the average 
reduction is 75.7%. The run times in Table 1 for GAMS/CPEEX are calculated using the 
“solvelink =1” option. This option allows GAMS to remain open while the solver is 
running. The GAMS default is to close when the solver is running in order to conserve 
memory. Run times for GAMS increase by about 30% if the default option is used with 
these data sets. 

While Table 1 shows how Xpress improves run times for IDCH, a more relevant 
comparison of the Xpress and GAMS/CPEEX implementations may be made by 
comparing answers to this question; How good is the solution obtained by IDCH in the 
amount of time an analyst would like to wait for an answer? To make this comparison, 
we run both versions of the IDCH for 15 minutes and compare the best interdiction plans 
found in terms of unmet demand. We use the ERCOT data for the comparison; see Table 
2 . 


Total 

Xpress; Unmet 

GAMS; Unmet 

Xpress; Iterations 

GAMS; Iterations 

Resources 

Demand (MWh) 

Demand (MWh) 

Completed 

Completed 

5 

40,413 

24,167 

47 

13 

10 

114,184 

90,947 

50 

13 

15 

427,924 

160,832 

58 

23 

20 

415,991 

356,996 

47 

13 


Table 2. Unmet demand when IDCH runs for 15 minutes on the ERCOT data, using 

Xpress or GAMS. (Xpress’s solution with 20 units of resource is worse than that 
given 15 units because IDCH is not guaranteed to find optimal solutions.) 
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Table 2 above shows that being able to eomplete more iterations in 15 minutes 
allows Xpress to find a better interdietion plan than GAMS. On average, in 15 minutes, 
the Xpress implementation is able to identify a solution that eauses 68.8% more 
disruption (unmet demand) than the GAMS implementation. Note that the unmet 
demand with 15 units of resouree is greater than with 20 units. This simply shows that 
the IDCH does not always find an optimal solution. When IDCH runs with 20 units of 
resouree, but starts with the best interdietion plan found in 15 minutes given 15 units of 
resource, it finds a plan that yields 450,595 MWh of unmet demand. 


E. XPRESS-MP PROGRAMMING TIPS 

The original plan for reimplementing IDCH was to take advantage of Xpress’s 
ability to solve related mathematical-programming problems multiple times with only a 
single model-generation step. However, if Mosel has generated two models, namely 
DCOPF and lAMP, and the sethidden () command (described below) is not used, the 
constraints of both models must be satisfied when solving either. This results in long run 
times. It is better to use Mosel’s sethidden () command to hide the constraints of the 
model that is not being solved. Unfortunately, any time this command is used, the model 
of interest must be regenerated. This drawback is offset by Mosel being more efficient 
than GAMS at model generation; thus generating the master problem and DCOPF once 
per iteration does not substantially increase overall run times in Xpress. By taking 
advantage of solving a modified problem without regenerating the model, the total 

P-\ 

generation time of the DCOPF is reduced by a factor of ^ compared to regenerating 
each of P DCOPF subproblems in every iteration of the heuristic in GAMS. 

Mosel makes efficient use of sparse linked lists, but the programmer must be 
careful about the related issue discussed here. IDCH must calculate the total flow across 
a bus. The following calculates “positive flow” for bus i\ 

forall(i in Bus) do 

Positive_Flow (i) := suiti(l in Line | 

(exists(Line_0(i,1)) and P_line_sol(1) > 0)) 

P_line_sol(1); 

end-do 
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where exists () enables the user to access a sparse linked list by only looking at the 
elements in that list. If exists were not used, the sum (1 in Line |...) would be 
taken over all lines, instead of just the few whose origin is bus i. However, what we 
really want to calculate is the total flow out of bus i, which is the sum of positive flows 
on lines that have bus i as an origin plus the absolute values of negative flow on lines that 
have bus i as a destination. That can be written as; 

forall(i in Bus) do 

Total_f low_out (i) := suiti(l in Line | 

(exists(Line_D(i,1)) and P_line_sol(1) < 0) or 
(exists(Line_0(i,1)) and P_line_sol(1) > 0)) 
abs(P_line_sol(1)); 

end-do 

However, this does not work as one might expect, and, in fact, sum (1 in Line |...) is 
taken over all lines. When handling the computation in this manner, it takes IDCH 72 
seconds to complete an iteration using the ERCOT data set. This calculation does not 
utilize the efficiency gained with dynamic arrays because of the or. However, the or 

can be equivalently replaced with a sum; 

forall(i in Bus) do 

Total_f low_out (i) := suiti(l in Line | 

exists(Line_D(i,1)) and P_line_sol(1) < 0) 
abs (P_line_sol (1) ) + siim(l in Line | 
exists(Line_0(i,1)) and P_line_sol(1) > 0) 
abs(P_line_sol(1)); 

end-do 

This allows us to take advantage of the efficiency gained by the exists () command 
and results in the time per iteration dropping to 12 seconds. 
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IV. COMPARING IDCH AND RULE-BASED HEURISTICS FOR 
IDENTIFYING EFFECTIVE INTERDICTION PLANS 


This chapter describes the teehniques that Albert, Albert and Nakarado [2004] 
(AAN) use for analyzing the “Struetural Vulnerability of the North American Power 
Grid” and eompares their effeetiveness to IDCH. 


A. GRID FUNCTIONALITY 

AAN attempt to analyze the vulnerability of the North American electrical power 
grid to terrorist attacks by using a surrogate for the funetionality of the network rather 
than direet, eleetrieal-engineering measures, as used in IDCH. They divide the grid into 
substations (i.e., nodes) and lines (i.e., ares) to represent a network. The substations are 
further divided into generating substations (direetly eonneeted to sourees of power), 
transmission substations (these transfer the power among high-voltage lines), and 
distribution substations (at the outer edge of the transmission grid, eonneeted by a single 
high-voltage line). Our grid data contain additional details on eomponents sueh as 
transformers and buses, whieh allows for a more detailed analysis. 

To develop a surrogate for grid funetionality, AAN use “an idealized view” of the 
grid that ignores constraints on line eapaeities, generator eapaeities and phase angles. 
They assume that a load (demand) ean be met as long as that load is eonneeted to at least 
one generating substation via at least one uninterdicted path of lines and substations. To 
measure the surrogates’ effeetiveness, AAN uses the coneept of eonneetivity loss, , 
defined as 


=100%x 


1 - 




where the index i corresponds to distribution substations, (8) denotes the number of 
generating substations that substation i is eonneeted to given interdietion plan 8, and 
is the corresponding value given the null interdietion plan, i.e., under normal 


21 



circumstances. (It turns out that all generators are connected to all distribution 
substations in the AAN data, so the denominator equals the number of generators times 
the number of distribution substations.) 

Clearly, connectivity loss is not a good measure of grid functionality, or the loss 
thereof, beeause it ignores the eleetrieal engineering realities of the grid. We use a more 
appropriate measure, “fraction of unmet demand” (FUD), defined as 

Unmet Demand for Energy 
Total Demand for Energy 

FUD must be defined over some “period of study,” whieh nominally eorresponds to the 
longest repair time of any interdicted component. 


B. HEURISTIC RULES FOR IDENTIFYING CRITICAL COMPONENTS IN 

AN ELECTRICAL GRID 

AAN attempt to identify sets of substations whose interdietion would most 
seriously degrade system funetionality. To do this, they sequentially seleet substations 
for interdietion using three heuristie rules. A set of distribution substations 5*1 is “more 
critical” than subset S 2 if interdiction of the substations in 5*1 leads to a higher value of Cl 
than does interdiction of the substations in S 2 . We will use their definition of 
“criticality,” except that system functionality will be measured through FUD. 

1. Degree-based Interdiction 

The first rule interdiets transmission substations in deereasing order of “substation 
degree.” The degree of a substation is the number of lines that are incident to it. This 
seems like a sensible rule because power grids are designed to have a certain level of 
redundancy, and targeting substations with the highest degree would seem to reduce this 
redundancy quickly. We implement this rule, but measure how well it performs (for the 
terrorists) in terms of FUD instead of Cl- Using this rule, AAN find that interdicting 5% 
of the transmission substations in their grid causes a connectivity loss of 45%. This 
translates to the average transmission substation eonneeting to 55% of the grid’s 
generators. 
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2. Static Pseudo-load-based Interdiction 

The second rule is based on what AAN call “load” at a transmission substation, 
but which we will call “pseudo-load.” (“Load” has a specific meaning in electric power 
engineering and the use of “pseudo-load” avoids confusion.) They assume that power is 
“routed” through the most direct path (i.e., from all generation substations to all other 
reachable substations), and define pseudo-load as the number of shortest paths from a 
generator to a distribution substation. The “static pseudo-load-based interdiction rule” 
computes pseudo-loads once at the transmission substations and then interdicts those 
substations in decreasing order of pseudo-load. This rule is “static” because pseudo-load 
is not recomputed after each interdiction. Using this rule, AAN find that interdicting 5% 
of the substations in their grid causes a connectivity loss of 60%. This translates to the 
average transmission substation connecting to 40% of the grid’s generators. 

We implement an analogous rule based on the actual load integrated over the 
LDC at each transmission substation, as calculated by the uninterdicted DCOPF model. 

3. Dynamic Pseudo-load-based Interdiction 

This rule is the same as the static pseudo-load-based rule above, except that after 
every ten interdictions, pseudo-load is recomputed. (AAN use the term “cascading” to 
describe this rule. We avoid using this term because of the confusion it might cause with 
the normal use of “cascading outages” in the power-engineering literature.) AAN 
recalculate pseudo-load after every ten interdictions, rather than after each interdiction, 
because of computational expense. Following this rule, AAN find that interdicting 5% of 
the transmission substations in their grid causes a connectivity loss of 90%. This 
translates to the average transmission substation connecting to only 10% of the grid’s 
generators. 

We implement an analogous rule using actual loads integrated over the LDC, but 
recalculate these loads, using DCOPF, after the interdiction of each subsequent 
substation. 

4. Extent of Possible Attacks 

The substations in our electrical grids are all transmission substations, so this 
thesis allows any substation to be interdicted. The substations are not part of the original 
NERC data, but VEGA identifies them by grouping adjacent transformers that are 
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connected to buses whose nominal voltages are 69kV and above. We assume no special 
security measures have been instituted at any substation because (a) we have no 
information about such measures, and (b) we want to compare to AAN, who assume no 
substations are protected. 

AAN evaluate connectivity loss in their grid data with up to 10% of the 
substations being interdicted. But, in their data this translates into as many as 1,028 
substations being attacked, which is clearly unreasonable. We assume that the best 
organized and most well-funded terrorist group could attack about 25 substations. (Even 
this seems unlikely, but it should bound the worst-possible situation.) 


C. ANALYSIS OF THE ERGOT ELECTRICAL GRID 

The first comparison of AAN’s techniques to IDCH uses the ERCOT electrical 
grid. The ERCOT data cover 4,993 lines, 946 transformers, 4,923 buses, 474 generators, 
and 499 substations. We also allow the interdiction of buses that lie outside of 
substations. However, the largest degree of such a bus is 10 and there are 26 substations 
with degree of 11 or greater. Therefore, this point is moot for the degree-based rule, and 
only substations will be interdicted. 

The degree-based rule is implemented to break ties arbitrarily, and there are ties in 
the ERCOT data. As a result, EUD is not unique when computed by this rule except for 
the last time a substation of a given degree is interdicted. In this scenario, unique values 
result from interdicting 1-5, 7, 11, 19, or 26 substations. Eigure 1 shows the value of 
EUD for ERCOT using the three rules proposed by AAN and by using IDCH. 
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Figure 1. Fraction of Unmet Demand, FUD, in the ERCOT grid while interdicting 

substations using rules adapted from Albert, Albert and Nakarado [2004] and 
using IDCH. IDCH finds the most disruptive set of substations to interdict in all 
cases. 

Figure 1 shows that IDCH identifies the most disruptive interdiction plan for the 
ERCOT grid. That is, the rules suggested by AAN lead to serious underestimates of the 
disruption that a well-funded, sophisticated terrorist group might cause. And, in other 
words, the grid is more vulnerable to attack than AAN’s method would lead an SO to 
believe. Eess sophisticated terrorists would want to use the dynamic load-based rule to 
guide their interdictions, and even less-sophisticated ones would want to use the static 
load-based rule. The worst rule, for the terrorists, is the degree-based rule. 

The best rule presented by AAN requires the interdiction of at least five 
substations before the terrorists achieve a EUD greater than 1%. IDCH demonstrates a 
significant disruption by interdicting just a single substation. If an SO were to use this 
type of analysis to decide which substations would benefit most from having extra 
security, IDCH would clearly provide the better tool. 
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D. ANALYSIS OF THE WECC ELECTRICAL GRID 

We apply the same teehniques as in the ERCOT example to the WECC grid. The 
WECC data eover 7,872 lines, 3,069 transformers, 8,436 buses, 1,400 generators, and 
1,264 substations. The WECC data provided by NERC, exhibits more eomponent 
aggregation (“equivaleneing”) than the ERCOT data does. This explains why the WECC 
data size is only twiee the size of ERCOT data, despite the faet that WECC eovers a 
geographieal area at least five times that of ERCOT. 

Onee again, we allow the interdietion of buses that lie outside of substations. The 
largest degree of sueh a bus is 13 and there are 24 substations with degree of 15 or 
greater. We limit the total number of interdietions to 24; therefore, no buses are 
interdieted with the degree-based rule. EUD is unique when evaluating 2-5, 9, 12, 17, or 
24 substations with this rule. Eigure 2 displays results. 

Eor simplieity, this analysis ignores extra eonstraints in WECC referred to as 
“nomogram limits.” More realistie studies should inelude these eonstraints beeause their 
omission eould lead to optimistie results for the SO. That is, the disruption levels 
identified here might be somewhat worse if the nomogram limits are enforeed. See 
Appendix C for a diseussion of nomogram limits. 
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Figure 2. Fraction of Unmet Demand, FUD , in the WECC grid while interdicting 

substations using rules adapted from Albert, Albert and Nakarado [2004] and 
using IDCH. Unlike ERGOT, the degree-based rule works well here, and is 
almost as good as IDCFl. 

Figure 2 shows that the load-based rules are worst for WECC. In contrast to 
ERCOT, the degree-based algorithm works well, nearly as well as IDCH. Our WECC 
data cover the peak demand period of the EDC during summer months. Consequently, 
the grid is operating near maximum capacity. We believe the high demand reduces the 
grid’s effective redundancy and explains why the degree-based rule works so well here. 
AAN find that their dynamic pseudo-load algorithm is the best, followed by the pseudo¬ 
load algorithm and lastly, the degree-based algorithm. Our adaptations of these strategies 
in the WECC grid show that such general conclusions do not apply when the physical 
realities of power flows are considered. 


E. INTERDICTING LINES IN AN ELECTRICAL GRID 

AAN only investigate the effects of interdicting substations. While removing 
substations from a grid would be very damaging, substations are relatively easy to protect 
from attack, at least in theory, because of their small “footprint.” For similar reasons. 
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buses and generators are easy to proteet. Transmission lines, on the other hand, run for 
hundreds of thousands of miles and are therefore diffieult to proteet. 

Although lines are easy to repair, beeause of their vulnerability, we believe that it 
is important to investigate their possible interdietion. Attaeking lines is, in faet, simple, 
as demonstrated by Colombian FARC terrorists, who have destroyed thousands of 230- 
kV and 500-kV towers sinee 1985. ISA spokesman aeknowledged, “We ean’t post a 
soldier at every tower” [Miami Herald 2002]. The last of these attaeks in September 
2005, destroyed six towers in the Cauea area, affeeting over three million people for 
several days and requiring emergeney restoration plans [El Pais-Cali Colombia 2005]. 
We investigate several heuristie rules for identifying the most eritieal sets of lines, and 
also apply IDCH. The three heuristie rules are: 

1. Capaeity-based interdietion: Intuitively, a line’s eapaeity seems like it 
might be a good indieator of its eritieality. Sinee it is easy to distinguish 
between high-eapaeity and low-eapaeity lines, a group of terrorists eould 
plausibly use this strategy for attacking a grid: Interdict the highest- 
capacity lines first, breaking ties arbitrarily. 

2. Static load-based interdiction: This rule is identical to “static load-based 
interdiction” as applied to substations, except that load now refers to the 
“load” (power averaged across the LDC) being carried by lines. The static 
load-based rule interdicts lines in decreasing order of the average power 
they carry as calculated by the uninterdicted DCOPF. 

3. Dynamic load-based interdiction: This rule is the same as (2) above, 
except that “load” is recomputed after each interdiction. 

As IDCH does, we treat lines that are physically parallel (i.e., mounted on the 
same tower) as single lines, subject to a single interdiction. And, of course, the load on 
the “composite line” is the sum of the individual loads. We examine the effects of line 
interdiction on FUD for the ERCOT dataset and assume that at most 25 lines would be 
interdicted. Figure 3 displays results. 
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Figure 3. Fraction of Unmet Demand, FUD, in the ERCOT network while interdicting lines 
using rule-base algorithms and IDCH. IDCH finds the most disruptive set of lines 
to interdict in all cases. 

Figure 3 shows that the static load-based rule is the worst rule for interdicting 
lines, and that the capacity-based rule is not much better. The dynamic load-based rule 
does start to show significant effects as the number of interdicted lines increases. IDCH 
identifies the most disruptive interdiction plan for the grid, and results obtained using the 
AAN-based rules underestimate the grid’s vulnerability to attack. IDCH shows that the 
ERCOT grid is somewhat vulnerable to line interdiction; Interdicting only 25 of 4,993 
lines, about 0.5%, results in an average of 9,953 MW being shed over 48 hours. This 
shedding exceeds 7% of the grid’s average demand. 
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V. CONCLUSIONS 


The VEGA software paekage is an integrated system for analyzing the 
vulnerability of eleetrie power-transmission grids to terrorist attaeks. At VEGA’s eore is 
an interdietion model that posits terrorists with limited offensive resourees. The goal of 
the model is to find near-optimal attaeks by using the information provided by power 
flow models for multiple grid eonfigurations under different load levels. This thesis 
reduees solution times for the Interdieting DC Optimal Power-Elow Heuristie (IDCH) by 
implementing the algorithm using Xpress-MP, a powerful optimization software paekage. 
Additionally, the thesis eompares the effeets of IDCH’s interdietion plans to the effeets of 
interdietion plans ereated using simple, heuristie rules, as suggested in the literature. 

Our new implementation of IDCH in Xpress-MP reduees solution times by 75.7% 
on average eompared to the previous implementation in GAMS when GAMS uses the 
highly effieient CPEEX solver. This now means that IDCH will often run in minutes 
rather than hours. We also find that the new implementation provides better solutions 
when run for a fixed length of time, beeause it ean eomplete more iterations. Eor 
instanee, in 15 minutes of run time, the Xpress-MP implementation identifies an 
interdietion plan that eauses 68.8% more disruption (unmet demand for energy) than does 
the GAMS-identified plan in the same amount of time; Xpress-MP eompletes 47 
iterations in this time while GAMS eompletes only 13 iterations. 

In addition to basie testing the new IDCH implementation has been exereised by 
analyzing the vulnerability of two real-world eleetrieal power grids to terrorist attaeks on 
its substations. The grid data are provided by the North Ameriea Eleetrie Reliability 
Couneil and eover the ERCOT grid (Eleetrie Reliability Couneil of Texas) and the 
WECC grid (Western Eleetrieity Coordinating Couneil). IDCH’s effeetiveness is 
evaluated by eomparing the interdietion plans it produees to those produeed using 
adaptations of the heuristie rules proposed by Albert et al. [2004]. These rules inelude; 
(a) interdiet the substation with the highest degree (most eonneeted) first, (b) interdiet the 
substation earrying the greatest baseline load first, and (e) interdiet the substation 
earrying the greatest load first, but reeompute that load after every interdietion. We find 
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that IDCH performs substantially better than the heuristic rules, although the degree- 
based rule works surprisingly well for the WECC grid. In contrast, it is the worst rule for 
ERGOT. Thus, IDCH produces much more consistent results than the rules from Albert 
et al. 

We also investigate how interdicting lines affects the ERGOT grid. IDCH finds 
that by interdicting as few as 25 lines results in 7.5% of the demand for energy going 
unmet. All of the rules suggested by Albert et al. perform poorly, in comparison. 
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APPENDIX A. MATHEMATICAL FORMULATION OF DCOPF 


The single period DC Optimal Power Flow Model from Salmeron et al. [2005] 
follows: 

Sets: 

i e / electrical buses 

i e 7° reference buses, I 

g&G generating units 

g e G. generating units connected to bus i, G. c G 

Ig L transmission lines and transformers 

/ e AC transmission lines and transformers modeled as AC 

lines, c L 

I e DC transmission lines, c L 

I e lines connected to bus i (AC and DC), c L 

I e Cf"'' lines in parallel with line /, c L 

c^C consumer sectors (e.g., residential, industrial) 

s^S substations 

i e 7j buses at substation 5 , 7, £ 7 

/ e lines connected to substation 5 (including 

transformers, which are represented by lines), 

g^G^ generators at substation s, G^ <^G 
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Parameters and [units] if applicable: 

o{l),d{l) origin and destination buses, respeetively for line / (more 
than one line with the same o{l), d{l) may exist) 

z (g) unique bus eonneeted to generator g, i.e., g e 

^(z) substation S that eontains bus ze (not all buses are 
eontained in substations) 

d.^ load of eonsumer seetor c at bus z [MW] 

transmission eapaeity for AC or DC line / [MW] 
maximum output from generator g [MW] 
minimum output from generator g [MW] 

r,, X, resistanee and reaetanee of AC line /, respeetively [p.u.] (We 
assume x, » r,) 

Bj series suseeptanee for AC line /, ealeulated as B^ = xJ (r/ + xf) 

[p.u.] 

Rj, P,, El resistance [f2], set point [MW] and voltage [kV] for DC line /, 
respectively 

jli transmission coefficient (= 1 - loss coefficient) on DC line 1, 

calculated as iii=\-I^RIP = \-P^RI[e^p) = \-PRI [p.u.] 

generation cost for generator g [$/MWh] 

fi^ load-shedding cost for customer sector c at bus z [$/MWh] 

Decision variables [units]: 

Pg‘"' generation from unit g [MW] 
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power flow on AC line / [MW] 


-pLine 

UI power flow from the “from” to the “to” bus for DC line / [MW]. 

(DC lines are modeled as follows: If > 0 MW are sent from the 
“from” bus, then (l-//^)f/, MW are reeeived at the “to” bus.) 

F) power flow from the “to” to the “from” bus of DC line / [MW]. 

(Similarly, if F; > 0 MW are sent from the “to” bus, then {\- jUi)V, 
MW are received at the “from” bus.) 

5*.^ load shed (unmet demand) for customer sector c at bus i [MW] 

phase angle at bus i [radians] 


Formulation: 


DCOPF: 


min 

,S,0,U,V 




+Z Z 

i c\d,i^>0 


(DCOPF. 1) 


s.t. 


pr=B,{e^^,r% 

) V/g 


(DCOPF.2) 

^ pGen ^ pLine _|_ 

g 

o(l)=i 

Z p‘"'+ Z {-v,+M,y,)+ Z (a4- 

d[l)-i d{l)=i 

v.) = 

Z (4-4) 

VzG / 


(DCOPF.3) 

pLine ^ pLine ^ "pLine 

V/g L 


(DCOPF.4) 

pGen ^ pGen ^ pGen 
^ ~ g ~ g 

< 

m 


(DCOPF.5) 


V/,c| 

>0 

(DCOPF.6) 

o 

II 

V/G f 


(DCOPF.7) 
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APPENDIX B. MATHEMATICAL FORMULATION OF lAMP 
(INTERDICTION-APPROXIMATING MASTER PROBLEM) 


The “interdicting approximating master problem” from Salmeron et al. [2005] 
follows; 

Sets: 

G* c G, T* c T , /* c /, iS* c iS, subsets of interdictable generators, lines, 
buses, and substations, respectively. 

Parameters: 

value for each generator g in iteration t 
value for each line / in iteration t 
value for each bus i in iteration T 
value for each substation s in iteration T 
resources required to interdict generator g 
Ml'"'*' resources required to interdict line / 

resources required to interdict bus i 
M/"* resources required to interdict substation 5 

M total resources available for interdiction 

Decision Variables: 

determines if generator g is interdicted in iteration r 
determines if line / is interdicted in iteration t 
determines if bus i is interdicted in iteration T 
determines if substation s is interdicted in iteration t 
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Formulation: 


fs:r 
k 


MP(f;): maxv;5 
s.t: 


X Ji^Gen^Gen,! ^ LinegLine,T ^ BusgBm,T y j^SubgSub,T < ^ 

g g ^ 

geG’ 


leL 


ieJ 


seS 


(MP.l) 


(MP.2) 


^Geny ^ ^ 

Vge G,nG*yi^f 

^Line,f gBus,T < j 

V/e I. nr,Vie I* 

^Line,T _|_ ^Liney ^ ^ 

V/'elf'"'nr,V/er 

^Bus,t _|_ ^Sub,T ^ ^ 

Vze^nr,V5e S* 

^Line,T _|_ ^Sub,T ^ 

yielnGyseS* 

^Genj _|_ ^Sub,T ^ 

S ^ 

Vge G^nG*yse S* 

^ ' ^^Geny' ^ ^ ^ ^^Liney' 

geG*\ leL*\ 

iel*\ 5g5*| 

_^L,ne,T)^ 

Vt' = 1,... 


(MP.3) 


^Suh ,T' _I 


oGen.t cLine.f cBus.f cSub.T 
Og ,Oi ,o. ( 


{0,1} 


Vge G\\flGL\ 
Vze fyse S* 


(MP.5) 


At each iteration T , (MP.l) interdicts the most valuable components based on the 
for each component k. (MP.2) prevents interdicting more components than total 

available resources, M, allow. (MP.3) prevents interdicting a component that is indirectly 
interdicted due to being connected to another directly interdicted component. (MP.3) 
assumes a bus is superior (i.e. takes longer to repair) than a line or generator and a 
substation is superior to a bus. If an inferior element is in fact superior (MP.3) relaxes for 
those two elements. (MP.4) prevents selecting an interdiction plan, 5, that has been 
selected in a previous iteration. (MP.5) forces all decision variables to be binary. 
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APPENDIX C. NOMOGRAMS 


A nomogram is simply a constraint on two or more lines that reduees the 
eombined eapaeity to less than the nominal sum of eapaeities. For two lines, this ean be 
represented by the following eonstraints: 

-pLine ^ pLine 
^i\ — 

pLine ^ pLine 
^12 — ^12 
pLine . pLine ^ 

^l\ '^^12 — 

where AC,j ,2 is the eombined eapaeity and n 

(Here we assume that positive values of and refleet flow in the direetion 
where the nomogram eonstraint applies.) Adding sueh a nomogram to the DCOPF model 
is aeeomplished by the following eode; 
declarations 

Nomo_flow: array (Line,Line) of real; 

Nomo_const: array (Line,Line) of linctr; 
end-declarations 


forall(l in Line, 11 in Line | exists (Nomo_flow(1,11))) do 
Nomo_const(1,11) := P_line(l) + P_line(ll) <= 

Nomo_flow(1,11) 

end-do 

Here, Nomo_f low (Line, Line) eontains the maximum flow that is allowed 
aeross the two lines simultaneously, and we may assume it is read from a data file as the 
rest of the problem data. 
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